For the private owner of a reportable automated data collection, the obligation to draw up processing regulations arises from Article 11 VDSG. These regulations should also describe the internal organization and the data processing and control procedures. For the preparation of the regulations, the owner of the data file can be guided by the template for federal bodies above.
Source: FDPIC – Technical and organizational data protection measures